This chapter covers the Deployment Imaging Servicing and Management (DISM) tool, a critical utility for repairing Windows system image corruption. DISM is a core topic under CompTIA A+ 220-1102 Domain 3.1 (Software Troubleshooting), and you can expect 1-2 questions on the exam directly testing DISM commands and their use cases. Mastering DISM is essential because it is the prerequisite for successful System File Checker (SFC) repairs—if you don't know when to use DISM before SFC, you'll waste time troubleshooting. This chapter provides the deep technical knowledge needed to pass exam questions and apply DISM in real-world support scenarios.
Jump to a section
Imagine a hospital where a patient (Windows) has a damaged organ (system files). The patient's own immune system (SFC) can only repair minor cuts and bruises by replacing individual damaged cells. But if the organ itself is structurally compromised—like a liver with scar tissue—the immune system can't fix it because it lacks the blueprint for healthy tissue. That's when you call in a surgeon with a specialized kit: DISM. The surgeon first checks the patient's medical records (component store) to see if the blueprint is intact. If the blueprint is corrupted, the surgeon accesses a clean donor blueprint from an external source (Windows Update or a mounted ISO). Using that blueprint, the surgeon carefully excises the damaged tissue and grafts healthy tissue in its place. After the surgery, the patient's immune system can now successfully repair individual cells because it has a correct blueprint to work from. Without DISM, the immune system (SFC) would keep trying to repair cells using a flawed blueprint, leading to repeated failures. This is exactly how DISM works: it repairs the component store (the 'blueprint') so that SFC can then repair individual files. The analogy is mechanistic because it maps directly: patient = Windows, damaged organ = corrupted system files, immune system = SFC, blueprint = component store, surgeon's kit = DISM, donor blueprint = clean source (Windows Update or ISO).
What is DISM and Why Does It Exist?
DISM (Deployment Imaging Servicing and Management) is a command-line tool built into Windows that services Windows images (.wim files) and the online operating system. It was introduced in Windows 7 and Windows Server 2008 R2, replacing older tools like Package Manager (pkgmgr.exe) and PEimg. DISM's primary purpose is to prepare, modify, and repair Windows system images, including the offline image used for deployment and the live running OS.
For the 220-1102 exam, the most critical function of DISM is repairing the Windows component store (also called the side-by-side store or WinSxS folder). The component store is a centralized repository of all Windows system files, including multiple versions of DLLs, executables, and manifests. When Windows updates or installs features, it stores backup copies of files in the component store. System File Checker (SFC) relies on the component store as its source of known-good file versions. If the component store itself becomes corrupted, SFC will fail to repair files because it's using a corrupted reference. DISM can repair the component store by replacing damaged files with fresh copies from Windows Update or a specified source (like a Windows installation ISO).
How DISM Works Internally
DISM operates by reading the component store's manifest files (.mum files) and catalog files (.cat files) that describe every component and its file versions. When you run a repair command, DISM compares the current state of the component store against a known-good baseline. It identifies corrupted or missing files by checking hash values stored in the manifests. If corruption is detected, DISM attempts to fetch replacement files from a source—by default, Windows Update, but you can also specify a local or network path to a Windows image (like a mounted ISO or a network share with the install.wim file).
The repair process works in two modes:
- Online servicing: Targets the currently running Windows installation. Commands like DISM /Online /Cleanup-Image /RestoreHealth are used.
- Offline servicing: Targets a mounted .wim or .vhd file. This is used for deployment scenarios or repairing a non-bootable system by booting from Windows PE.
Key Components, Values, Defaults, and Timers
Component Store Location: C:\Windows\WinSxS
Default Source: Windows Update (Microsoft servers). You can override with /Source parameter pointing to an install.wim or a side-by-side folder.
Log File: %windir%\Logs\DISM\dism.log — detailed log of operations.
CheckHealth: Quick scan to see if component store is marked as corrupted. It does not repair. Example: DISM /Online /Cleanup-Image /CheckHealth
ScanHealth: Deeper scan that checks for corruption. Reports if corruption exists but does not repair. Example: DISM /Online /Cleanup-Image /ScanHealth
RestoreHealth: Scans for corruption and repairs automatically using Windows Update. Example: DISM /Online /Cleanup-Image /RestoreHealth
Cleanup-Image: Used with various switches like /StartComponentCleanup (removes superseded components to reclaim disk space) and /ResetBase (removes all superseded versions of components, making the component store smaller but preventing uninstallation of recent updates).
LimitAccess: Prevents DISM from contacting Windows Update. Used with /Source to force local source only.
Configuration and Verification Commands
To check the health of the component store:
DISM /Online /Cleanup-Image /CheckHealthOutput example: "No component store corruption detected." or "The component store is repairable."
To perform a deeper scan:
DISM /Online /Cleanup-Image /ScanHealthThis may take 10-20 minutes. The output indicates whether corruption is found.
To repair the component store:
DISM /Online /Cleanup-Image /RestoreHealthThis command downloads replacement files from Windows Update. If Windows Update is unavailable, specify a source:
DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\mount\windows\install.wim /LimitAccessTo clean up the component store:
DISM /Online /Cleanup-Image /StartComponentCleanupTo reset the base of the component store:
DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBaseHow DISM Interacts with Related Technologies
DISM is often used in conjunction with SFC. The correct order is: first run DISM /RestoreHealth, then run sfc /scannow. This is because SFC relies on the component store; if the store is corrupt, SFC will fail. DISM fixes the store, then SFC can repair individual system files.
DISM is also used with Windows PE (Preinstallation Environment) for offline repairs. For example, if Windows won't boot, you can boot from a Windows PE USB drive, mount the offline Windows installation, and run DISM against it:
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:C:\sources\install.wimIn deployment scenarios, DISM is used to mount .wim images, add or remove drivers, enable or disable Windows features, and apply updates before deploying the image. For example:
DISM /Mount-Image /ImageFile:C:\install.wim /Index:1 /MountDir:C:\mount
DISM /Image:C:\mount /Add-Driver /Driver:C:\drivers\driver.inf
DISM /Unmount-Image /MountDir:C:\mount /CommitSpecific Numbers and Defaults
The component store (WinSxS) can grow to several gigabytes; StartComponentCleanup can reclaim 1-2 GB typically.
ResetBase permanently removes old versions; after this, you cannot uninstall cumulative updates that have superseded older ones.
The /LimitAccess switch is crucial when troubleshooting without internet access; it prevents DISM from attempting to contact Windows Update.
DISM commands are case-insensitive but must be run from an elevated Command Prompt (Run as Administrator).
On Windows 10/11, DISM is version 10.0.x. The tool is included by default; no separate download is needed.
Common Errors and Troubleshooting
Error 0x800f081f: "The source files could not be found." This means DISM could not access Windows Update or the specified source. Solution: Use /Source with a valid install.wim and /LimitAccess.
Error 0x800f0906: "The source files could not be downloaded." Often due to network issues or Windows Update being blocked. Check internet connectivity or use a local source.
Error 0x800f0907: "The source files could not be downloaded because of network restrictions." Similar to above; use /LimitAccess and specify a local source.
DISM hangs or takes too long: Usually because it's trying to contact Windows Update. Use /LimitAccess to force local source.
Exam-Tested Scenarios
The 220-1102 exam will present scenarios where:
A user reports that SFC cannot repair corrupt files. The correct first step is to run DISM RestoreHealth.
You need to repair a non-bootable Windows installation. You must boot from Windows PE and use DISM with /Image parameter.
You need to free up disk space by cleaning the component store. Use DISM /Online /Cleanup-Image /StartComponentCleanup.
You need to install a Windows feature offline in a deployment image. Use DISM /Image /Enable-Feature.
Remember: DISM is the tool for repairing the component store; SFC is for repairing individual system files. The exam will test your knowledge of when to use each.
Open Elevated Command Prompt
DISM requires administrative privileges. Click Start, type 'cmd', right-click Command Prompt, and select 'Run as administrator'. If you use PowerShell, run as Administrator and use `dism` command. Always ensure the console is elevated; otherwise, DISM will fail with 'You must be an administrator running a console session' error.
Run CheckHealth to Assess Status
Execute `DISM /Online /Cleanup-Image /CheckHealth`. This command reads a flag in the registry that indicates whether the component store has been previously marked as corrupt. It does not perform a scan; it simply reports the last known state. If it says 'No component store corruption detected', the store was previously healthy. If it says 'The component store is repairable', corruption was detected earlier. This is a quick check (seconds) but not definitive.
Run ScanHealth for Deep Scan
Execute `DISM /Online /Cleanup-Image /ScanHealth`. This command performs a thorough scan of the component store by comparing files against the manifest hashes. It may take 10-20 minutes depending on system speed and store size. The output indicates whether corruption is found. If corruption is detected, it logs the details but does not repair. This step is essential before running RestoreHealth to confirm the need for repair.
Run RestoreHealth to Repair
Execute `DISM /Online /Cleanup-Image /RestoreHealth`. This command scans and repairs the component store automatically. It first contacts Windows Update to download clean versions of corrupted files. If Windows Update is unavailable or you have a local source, use `/Source` and `/LimitAccess`. The repair process can take 15-30 minutes or longer. After completion, reboot the system.
Run SFC /scannow to Fix Files
After DISM restores the component store, run `sfc /scannow` to repair individual system files. SFC now has a healthy reference. This step is critical because DISM fixes the store, but SFC actually replaces the corrupted system files with the correct versions. Without this step, some files may remain corrupt. SFC will also log results to `%windir%\Logs\CBS\CBS.log`.
Enterprise Scenario 1: Remote Desktop Server with Frequent Blue Screens
A company runs a Windows Server 2019 RDS environment with 200 users. After a failed Windows update, several servers experience random blue screens. SFC reports corrupt files but cannot repair them. The IT team runs DISM /Online /Cleanup-Image /RestoreHealth on each server, specifying a local network share containing the Windows Server 2019 ISO files as the source (/Source:\\fileserver\sources\install.wim /LimitAccess). This avoids saturating the internet link. After DISM repairs the component store, SFC successfully fixes the files. The blue screens stop. Without DISM, the team would have had to rebuild the servers from scratch, causing days of downtime. Performance consideration: Running DISM on multiple servers simultaneously can strain the network share; they stagger the repairs to avoid bandwidth issues.
Enterprise Scenario 2: Deploying Custom Windows Images to 10,000 Workstations
A large enterprise uses MDT (Microsoft Deployment Toolkit) to deploy Windows 10 images to thousands of workstations. They need to add a custom driver and enable the .NET Framework 3.5 feature offline. They use DISM to mount the install.wim, add the driver, enable the feature using /Enable-Feature /FeatureName:NetFx3 /Source:C:\sources\sxs, and commit the image. This avoids the need to install these components post-deployment, saving 15 minutes per workstation. If the component store in the image becomes corrupt, DISM can repair it offline before deployment, ensuring a consistent OS. Misconfiguration: If they forget to use /LimitAccess when specifying a local source, DISM may attempt to contact Windows Update during deployment, causing delays or failures in isolated networks.
Enterprise Scenario 3: Recovering a Non-Bootable Domain Controller
A domain controller fails to boot after a disk error. The administrator boots from a Windows Server installation USB, opens Command Prompt (Shift+F10), and runs DISM against the offline Windows directory: DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:E:\sources\install.wim /LimitAccess (where D: is the system drive, E: is the USB). This repairs the component store. Then they run sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows to fix system files. The DC boots successfully. Without this technique, they would need to restore from backup or rebuild the DC, which could take hours. Common mistake: Not specifying the correct drive letters; they use diskpart and list volume to identify the correct volumes.
What 220-1102 Tests on DISM (Objective 3.1)
The exam focuses on DISM as a troubleshooting tool for Windows system file corruption. Key points:
- When to use DISM vs SFC: DISM is for repairing the component store (WinSxS); SFC is for repairing individual system files. The exam will give a scenario where SFC fails and ask what to do first—the answer is DISM RestoreHealth.
- Command syntax: You must know the exact commands: DISM /Online /Cleanup-Image /RestoreHealth, DISM /Online /Cleanup-Image /ScanHealth, DISM /Online /Cleanup-Image /CheckHealth. The exam may present a command with typos or wrong switches; you must identify the correct one.
- Source options: Understanding /Source and /LimitAccess is critical. The exam might ask how to repair a system without internet access—answer: use a local source and /LimitAccess.
- Offline repair: You need to know that DISM can target an offline image with /Image parameter, used when booting from Windows PE.
- Disk cleanup: /StartComponentCleanup and /ResetBase are tested as methods to free disk space.
Common Wrong Answers and Why Candidates Choose Them
Running SFC first: Candidates think SFC is the universal repair tool. But if the component store is corrupt, SFC fails. The exam tests that DISM must be run before SFC.
Using `sfc /scannow /offbootdir` without DISM: For offline repair, candidates may jump to SFC offline without repairing the store first. The correct order is DISM then SFC.
Choosing `DISM /Online /Cleanup-Image /CheckHealth` as a repair command: CheckHealth only checks status, not repairs. Candidates might see 'repairable' and think it's fixed. The correct repair command is RestoreHealth.
Forgetting `/LimitAccess`: When using a local source, candidates might omit /LimitAccess, causing DISM to hang trying to reach Windows Update. The exam may present this scenario and ask why the command is failing.
Specific Numbers and Terms on the Exam
The component store is located in C:\Windows\WinSxS.
The log file is %windir%\Logs\DISM\dism.log.
Error 0x800f081f indicates source files not found.
The command to clean up superseded components is DISM /Online /Cleanup-Image /StartComponentCleanup.
The /ResetBase switch permanently removes old versions.
Edge Cases and Exceptions
Windows Update is blocked by firewall: DISM will fail. Use /Source and /LimitAccess.
Corrupted install.wim: If the local source is also corrupt, DISM cannot repair. You need a known-good source.
Running DISM in Safe Mode: DISM works in Safe Mode but may not be able to contact Windows Update; use local source.
DISM on Windows 7: Commands are similar but some switches differ slightly; the exam focuses on Windows 10/11.
How to Eliminate Wrong Answers
Understand the mechanism: DISM repairs the blueprint (component store), SFC repairs the files. If a question says 'SFC cannot repair files', the answer must involve DISM first. If the system is offline, look for /Image or /Offline parameters. If the question mentions disk space, look for /StartComponentCleanup. Always eliminate answers that suggest running SFC before DISM or using CheckHealth as a repair.
DISM (Deployment Imaging Servicing and Management) is used to repair the Windows component store (WinSxS).
Always run DISM /RestoreHealth before SFC /scannow when system file corruption is suspected.
Use /CheckHealth for a quick status check, /ScanHealth for a deep scan, and /RestoreHealth to repair.
When no internet access, use /Source with a path to a valid install.wim and /LimitAccess to prevent Windows Update contact.
For non-bootable systems, boot from Windows PE and use DISM /Image:<drive>: /Cleanup-Image /RestoreHealth.
To free up disk space, use DISM /Online /Cleanup-Image /StartComponentCleanup (optionally with /ResetBase).
Error 0x800f081f means source files not found; check your source path and use /LimitAccess.
These come up on the exam all the time. Here's how to tell them apart.
DISM
Repairs the Windows component store (WinSxS)
Can repair offline images using /Image parameter
Commands: /CheckHealth, /ScanHealth, /RestoreHealth
Can use Windows Update or local source for repair files
Used for deployment and image servicing (add drivers, features)
SFC
Repairs individual system files using component store as reference
Only works on online OS (except /offbootdir in Windows PE)
Command: sfc /scannow
Relies solely on component store; cannot use external source
Limited to file replacement; cannot service images
Mistake
DISM and SFC do the same thing.
Correct
They serve different purposes. DISM repairs the component store (WinSxS) which is the source of truth for system files. SFC repairs individual system files using the component store as reference. DISM is the prerequisite for SFC; if the store is corrupt, SFC will fail.
Mistake
DISM /CheckHealth repairs the component store.
Correct
CheckHealth only checks a registry flag to see if the store was previously marked as corrupt. It does not scan or repair. The correct repair command is /RestoreHealth.
Mistake
DISM can only repair the online OS.
Correct
DISM can also service offline images using the /Image parameter. This is used when booting from Windows PE or when mounting a .wim file for deployment. For example: DISM /Image:C:\ /Cleanup-Image /RestoreHealth.
Mistake
You can run DISM without administrator privileges.
Correct
DISM requires elevated privileges. Running without 'Run as administrator' will result in an error: 'You must be an administrator running a console session'.
Mistake
After running DISM RestoreHealth, you don't need to run SFC.
Correct
DISM repairs the component store, but the actual system files may still be corrupt. SFC /scannow is still needed to replace the damaged files with the now-healthy copies from the store.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
DISM repairs the component store (WinSxS) which is the database of system files. SFC repairs individual system files by comparing them to the copies in the component store. If the component store is corrupt, SFC will fail. Therefore, you should run DISM first, then SFC.
Boot from a Windows installation USB or Windows PE. Open Command Prompt (Shift+F10). Use diskpart to identify the system drive (e.g., D:). Then run: DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:E:\sources\install.wim /LimitAccess (where E: is the USB drive).
It checks a registry flag to see if the component store has been previously marked as corrupt. It does not perform a scan or repair. It only tells you if the store was reported as repairable in a previous session. For a real scan, use /ScanHealth.
DISM is likely trying to contact Windows Update and timing out. To prevent this, use the /LimitAccess switch and specify a local source with /Source. For example: DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\sources\install.wim /LimitAccess.
No, DISM is designed to repair system files and the component store. It does not fix registry hives. For registry corruption, you would need to restore from backup or use system restore.
It removes superseded versions of components from the WinSxS folder, freeing up disk space. Adding /ResetBase removes all old versions permanently, preventing uninstallation of recent updates. This is useful for reclaiming space on systems with limited storage.
After running RestoreHealth, you can run DISM /Online /Cleanup-Image /CheckHealth again. If it says 'No component store corruption detected', the repair was successful. You can also check the log file at %windir%\Logs\DISM\dism.log for details.
You've just covered DISM Tool for Windows Repair — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?